Cisco Talos Intelligence for Enterprise Security Cloud up to 1.0.2 Talos intelligence enrichment REST endpoint server-side request forgery

Summaryinfo

A vulnerability classified as critical was found in Cisco Talos Intelligence for Enterprise Security Cloud up to 1.0.2. This affects an unknown function of the component Talos intelligence enrichment REST endpoint. The manipulation results in server-side request forgery. This vulnerability is identified as CVE-2026-76389. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, was found in Cisco Talos Intelligence for Enterprise Security Cloud up to 1.0.2. Affected is an unknown function of the component Talos intelligence enrichment REST endpoint. The manipulation with an unknown input leads to a server-side request forgery vulnerability. CWE is classifying the issue as CWE-918. The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination. This is going to have an impact on confidentiality, integrity, and availability. CVE summarizes:

In Cisco Talos Intelligence for Enterprise Security Cloud versions below 1.0.3, a user that holds a role with the get_talos_enrichment capability could send a crafted request to the Talos intelligence enrichment Representational State Transfer (REST) API endpoint and cause the instance to make an outbound request to an attacker-controlled server. The request could expose tokens that compromise all relevant data and system integrity in the Splunk instance. The vulnerability is possible because the Talos intelligence enrichment REST endpoint accepts the destination for authenticated Splunk management requests from request data. For more information see Deploy Cisco Talos Intelligence for Splunk Enterprise Security (https://help.splunk.com/en/splunk-enterprise-security-8/user-guide/8.0/introduction/deploy-cisco-talos-intelligence-for-splunk-enterprise-security-cloud-only) in the Splunk documentation.

The advisory is shared for download at advisory.splunk.com. This vulnerability is traded as CVE-2026-76389 since 08/19/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. There are neither technical details nor an exploit publicly available. The current price for an exploit might be approx. USD $0-$5k (estimation calculated on 08/19/2026).

Upgrading to version 1.0.3 eliminates this vulnerability.

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Cloud Software

Vendor

• Cisco

Name

• Talos Intelligence for Enterprise Security Cloud

Version

• 1.0.0
• 1.0.1
• 1.0.2

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion